1. Technical Field
The present disclosure relates generally to security and, more particularly, to a method and apparatus for providing computer security.
2. Description of the Related Art
With the growth of the Internet, the increased use of computers and the exchange of information between individual users poses a threat to the security of computers. Computer security attempts to ensure the reliable operation of networking and computing resources and attempts to protect information on the computer or network from unauthorized corruption, access or disclosure. Computer system(s) as referred to herein may include(s) individual computers, servers, computing resources, applications, operating systems, networks, etc. Among the various security threats that present increasingly difficult challenges to the secure operation of computer systems are malicious software, such as computer viruses, worms, Trojan horses, etc. Such malicious software may be autonomous software agents that can cause mild to severe damage to computer systems by replicating and spreading themselves to a plurality of other computer systems.
Unwanted and/or unsolicited communications, for example emails, (collectively called SPAM) may present a similar challenge to computer systems and users. For the sake of understandability, the term “virus” is used herein as a general term and may include other forms of malicious software, such as worms and Trojan horses as well as other forms of undesirable transmissions, such as SPAM.
Computer viruses are programs that can infect other programs by modifying them in such a way as to include a copy of themselves. Unlike computer viruses, worms do not need to infect other programs. Worms are independent programs that are capable of reproducing themselves, spreading from machine to machine across network connections, often via email. A Trojan horse may be an executable program that appears to be desirable but is merely disguised as “friendly” and actually contains harmful code, allowing an attacker to come in through a “back door” and perform malicious actions on the computer system.
A software exploit may be characterized as a weakness or a “bug” in a computer system that makes the computer system highly vulnerable to malicious software attacks, such as computer viruses, worms, Trojan horses, etc. Malicious software is typically built upon software exploits and takes advantage of security flaws in computer systems. For example, a buffer overflow attack or buffer overrun bug may allow attackers to run arbitrary code on a computer system, such as, for example, a web server. These buffer overflow attacks may occur when a program attempts to write more data onto a buffer area in the web server than it can hold. This causes an overwriting of areas of stack memory in the web server and if performed correctly, allows malicious code to be placed on the web server which would then be executed.
Computer systems may utilize anti-virus programs in order to protect themselves from malicious software such as computer viruses, worms, Trojan horses, etc. One approach involves using anti-virus programs, such as virus scanning programs, to protect against the spread of viruses. Virus scanning programs may detect the virus and then isolate and remove the viral code. For example, the virus scanning program may contain a list of previously defined virus signatures, containing the binary patterns of a virus, each associated with a virus and scan the various files of a system looking for a match to a particular virus signature. If a virus is detected, the user may be notified and further steps may be taken to rid the system of the malicious code. However, virus scanning programs such as those mentioned above are time consuming and may not provide a computer system with comprehensive protection against malicious software attacks. For example, virus scanning software may detect viruses present in the system, but it may do nothing to prevent them from infiltrating the system in the first place. In other words, such an approach has no benefit until a virus is actually developed against a software exploit. By that time, the malicious software will have caused considerable damage to the computer system. In addition, the virus scanning software should be continuously updated in order to be effective in detecting new and modified malicious software attacks. This not only proves to be a very tedious and time consuming task for computer users, but also may not happen often enough to provide adequate safeguards against foreign intrusions.
Another anti-virus approach involves scanning a computer system in order to determine if the system may be vulnerable to software exploits. However, this approach is also time consuming and may not provide a computer system with comprehensive protection against malicious attacks. For example, the time required to scan all the computer systems in an organization may be long. Therefore, such a scanning strategy can monopolize and bog down an organization's computer systems, decreasing productivity. In addition, this approach may rely on a security service provider to generate signatures for computer systems which may be at risk from any given exploit. The combination of factors required to produce certain vulnerabilities may be complex. In the situation where multiple exploits have been released near the same point in time, a security service provider may have limited resources and will have to prioritize their responses to each exploit.
A more prevalent problem with software exploits is that the time between the release of a software exploit and the release of malicious software using the exploit is growing shorter. Some security experts find that “zero-day” exploits, code that takes advantage of previously unknown computer system vulnerabilities, are a growing threat. For example, the creator of the Slammer worm allowed network administrators six months to patch their systems before the worm was released in January 2003, the Sasser worm appeared in April 2004, three weeks after the associated software exploit was made public, and the Witty worm hit two days after a software exploit allowed it to spread.
Accordingly, it would be beneficial to provide a reliable, fast and efficient way to identify computer systems that contain vulnerable software exploits before a malicious software attack is launched.